Kevin Hunt: She Fills Rx, Gets Invite To Clinical Study. HIPAA?

Marie Levine received more than medication when she filled a prescription recently at a local Walgreens pharmacy, even though she didn't know it at the time.

Days later, Walgreens sent a letter inviting Levine to participate in a clinical drug trial that offered up to a year of care and monitoring by a local doctor, no health insurance required, and payment of up to $550. The investigational study drug treats a disease she doesn't have, though she needed immediate treatment for a sudden case of invasion of privacy.

Most consumers know HIPAA as the guardian of "protected health information," but few know the exceptions to its privacy provisions and even fewer people probably know HIPAA by its full name, derived from the Health Insurance Portability and Accountability Act of 1996.

Victoria Veltri, the state healthcare advocate, asked to see a redacted copy of the Walgreens letter Levine received when contacted by The Bottom Line. But that wasn't enough.

"Will have to look at their HIPAA policy," she says. ??

Walgreens 2,085-word notice (available at bit.ly/14LgPzn) includes this passage under "Research":

"We may disclose your [protected health information] to researchers when their research has been approved by an institutional review board or privacy board that has reviewed the research proposal and established protocols to ensure the privacy of your information."

Walgreens, however, says it did not share Levine's personal information with AccurianHealth, the research group conducting the study.

"The letter the customer received was sent directly from Walgreens," says Emily Hartwig, a spokeswoman for Walgreen Co., the pharmacy's corporate owner. "We do not, in any circumstance, share personal information with research study sponsors."

The letter includes a disclaimer noting that AccurianHealth paid the costs of the mail campaign, compensated Walgreens and did not receive personal information about people invited into the study. Levine remains unconvinced.

"I realize they are trying to claim they are 'committed to privacy," she says. "However, this letter proves there is an extreme invasion of privacy if my name has been entered into a database of a company who has a relationship with Walgreens. They are assuming my situation is relevant to their study, which it is not. But because my medication has been 'flagged' by them, Walgreens has given them this information, without my consent."

It might appear AccurianHealth knows something about Levine, but it's actually Walgreens that used her prescription history to offer her a chance to join a clinical drug study. It's also a way for Walgreens to make some money, too.

"These studies are voluntary," says Walgreens in a prepared statement sent to TBL, "and give our customers and patients an opportunity to participate in clinical trials, which contribute greatly to the overall progress in understanding and treating diseases and Walgreens supports that mission. . . . If a patient elects to qualify for a study, they can choose whether to share any personal information. We apologize for any misunderstanding."

The Connecticut Insurance Department's consumer affairs division says it has not received any complaints about research-study invitations associated with prescription drug coverage.

"Nada," says spokeswoman Donna Tommelleo. "They have no knowledge of AcurianHealth or complaints against them."

The state Department of Consumer Protection, which regulates pharmacies, also considers the Walgreens letter an acceptable recruitment tool within HIPAA standards.

"There does not appear to be any violation," says spokeswoman Claudette Carveth. "More consumer input is where pharmacy health care is heading. The companies want to see if the products are working properly, patient compliance, side effects, etc. Consumers who do not want to participate may say no."

Levine said no but accepted an invitation in the letter to call a toll-free number and tell Walgreens she wants no more mailings about research studies.

"While my [condition] is not a particularly uncommon ailment," she says, "I am very disturbed for any future problems I, or anyone else, may have that they would not want shared with anyone other than a personal medical provider. You can tell them I'm planning no changing all of my family's prescriptions to CVS."

Hold on, Marie. HIPAA requires every pharmacy, including CVS, to post its privacy practices. In its 2,634-word notice (find it at bit.ly/14oCsqo), CVS says it may tell customers about "opportunities that may be of interest to you."